ISO 14001:2015: documentation and compliance requirements

This is what ISO 14001:2015 requires you to have, clause by clause, and what an auditor will ask to see for each of it. It covers 62 requirements across 7 areas.

It is deliberately not a checklist. A checklist asks whether you have something; this says what is required and what counts as evidence, which is the question that matters when you are building a system rather than testing one. If you would rather find out where you stand first, the same ground is covered by our free ISO 14001:2015 readiness assessment, which scores you out of 100.

4 Your organisation and what affects it

Clauses 4.1, 4.2, 4.3, 4.4.

You must have written down the outside things that affect the environment side of your business — laws, weather, local community, customers, supply of materials.

Evidence: A short list or table of these issues, with a note of when you last looked at it.

You must have written down the inside things that affect it — your equipment, buildings, skills, money, how you work.

Evidence: The same list, covering internal issues.

You must have thought about climate change both ways — how it could affect you, and how you affect it.

Evidence: A recorded decision covering flooding, heat, water shortage, storms, and your own emissions.

You must have listed the people and bodies with an interest — regulator, neighbours, customers, staff, landlord, insurer.

Evidence: A list of these groups.

For each one, you must have written down what they expect, and decided which of those expectations you must meet.

Evidence: Their expectations, and which you have accepted as a duty. Those accepted become compliance obligations.

You must have written down what your environmental system covers — which sites, activities, products and services.

Evidence: A scope statement. Site plans or boundaries.

The scope must include everything that has a real environmental impact, rather than leaving awkward parts out.

Evidence: The reasoning. You cannot draw the boundary to dodge your worst impacts.

You must know what your main processes are and how they fit together.

Evidence: A process map or a list of processes with owners.

5 Leadership

Clauses 5.1, 5.2, 5.3.

The owner must be able to or senior manager point to environmental decisions they made in the last year.

Evidence: Management review notes. Spend approved. Ask them directly.

Senior managers must make sure the environmental system has the time, money and people it needs.

Evidence: Budget. Staffing. Evidence a request was granted.

You must have a written environmental policy that fits the size and nature of what you do.

Evidence: The policy, signed and dated.

The policy must promise all three things: to protect the environment and prevent pollution, to meet your legal duties, and to keep improving.

Evidence: All three promises visible in the text. Missing one is a common finding.

The must be policy shared with your people, and available to anyone outside who asks for it.

Evidence: Where it is displayed or published. Ask staff whether they know it exists.

It must be clear who is responsible for what, including who deals with a spill or an emergency.

Evidence: Organisation chart. Responsibility list. Emergency roles and contact numbers.

6 Planning — impacts, legal duties and objectives

Clauses 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.2.1, 6.2.2.

You must have worked out what could go wrong environmentally, and what opportunities you could take.

Evidence: A risk and opportunity list linked back to your issues and your interested parties.

You must have listed the ways your activities, products and services touch the environment — waste, emissions, discharges, energy, water, materials, land.

Evidence: An aspects register covering every site and activity.

That list must cover abnormal situations and emergencies too, not just a normal day.

Evidence: Aspects considered for start-up, shutdown, breakdown, spill and fire.

You must have thought about the whole life of your product or service — buying in, making, delivering, using, disposing.

Evidence: Evidence you considered the stages before and after your own site. A full life cycle study is not required.

You must have decided which of those impacts are the significant ones, using written criteria.

Evidence: The criteria you used. Which aspects came out as significant, and why.

You must know which environmental laws, permits and other duties apply to you, and how you keep that list current.

Evidence: A legal register. Permits and consents with expiry dates. A subscription or update service.

The people must who have to follow those duties actually know about them.

Evidence: Evidence the requirements reached the shop floor, not just the file.

You must have planned actions to deal with your significant impacts, your legal duties and your risks.

Evidence: An action plan linking each significant aspect and duty to a control or an action.

Those must be actions built into how you work day to day, rather than sitting on a separate list.

Evidence: Controls in the procedures, not only in the register.

You must have set environmental objectives, and they must be able to be measured.

Evidence: Objectives with a baseline, a target and a unit. 'Be greener' is not measurable.

For each objective, it must be clear what will be done, by whom, by when, with what, and how you will judge the result.

Evidence: An action plan covering all five points. Progress updates.

7 Support — people, communication and documents

Clauses 7.1, 7.2, 7.3, 7.4.1, 7.4.2, 7.4.3, 7.5.1, 7.5.2, 7.5.3.

You must provide the people, money, equipment and systems the environmental system needs.

Evidence: Budget. Staffing. Equipment bought. Monitoring kit.

You must know what skills each environmentally important job needs, and you must be able to show the people have them.

Evidence: Skills matrix. Licences where the law requires them — waste carrier, refrigerant handling, effluent.

You must check that contractors doing environmentally important work are competent.

Evidence: Contractor checks before they start. Copies of their licences.

Your people must know the policy, the impacts of their own job, and what happens if a legal duty is missed.

Evidence: Induction and toolbox talks. Signage at the point of use. Ask staff — this is how it is tested.

You must have decided what needs to be communicated about the environment, to whom, when and by whom.

Evidence: A simple communication plan or table.

Your own must people have a way to suggest improvements or report a problem.

Evidence: Suggestion route. Records that it gets used and answered.

You must deal with enquiries and complaints from neighbours, regulators and customers, and keep a record.

Evidence: A complaints log with what you did. Correspondence with the regulator.

You must have the documents and records the standard asks for, plus whatever else you need.

Evidence: A list of documents and records held.

When a document is created or changed, it must be checked and approved before people use it.

Evidence: Approval on the document — signature, system record or version note.

People must be able to find the current version where they need it, and are old versions taken away.

Evidence: How documents are shared. Old copies removed from noticeboards and shared drives.

Records must be kept safe and kept for as long as required — including longer periods set by permits.

Evidence: A retention list. Note that permits often demand longer than your own rules.

8 Doing the work, and emergencies

Clauses 8.1, 8.2.

For the activities with significant impacts, you must have set out how the work must be done.

Evidence: Procedures, work instructions, permits to work, storage and bunding rules, waste segregation.

You must check that those controls are actually being followed.

Evidence: Inspection records. Housekeeping checks. Monitoring results.

You must control contractors and suppliers whose work affects the environment.

Evidence: Site rules and inductions. Environmental terms in contracts. Checks on their work.

You must tell suppliers and contractors what you need from them environmentally.

Evidence: Purchase specifications. Contract clauses. Waste transfer arrangements.

You must be able to answer: Have life cycle considerations changed any decision you have made — in buying, design, packaging, transport or disposal?

Evidence: One or two real examples. A supplier chosen on environmental grounds, a material changed, packaging reduced.

You must have worked out what emergencies could happen — spill, fire, flood, leak, loss of containment.

Evidence: A list of possible emergencies for each site.

You must have arrangements to deal with them, and the equipment to do it.

Evidence: Emergency plans. Spill kits, bunds, absorbents, extinguishers, with inspection records.

You must have tested those arrangements, and you must have change anything as a result.

Evidence: Drill records with dates and what went wrong. Plans updated afterwards.

9 Checking how you are doing

Clauses 9.1.1, 9.1.2, 9.2.1, 9.2.2, 9.3.

You must have decided what environmental things you will measure, how, and how often.

Evidence: A monitoring plan. Energy, water, waste, emissions and discharge readings.

You must know your measurements are reliable.

Evidence: Calibration certificates for monitoring equipment. Accreditation of any lab you use.

You must look at the results, spot trends, and act on them.

Evidence: Trend charts. Actions taken from what the data showed.

You must check, on a set schedule, whether you are actually complying with every legal duty on your register.

Evidence: A compliance evaluation with dates and conclusions against each duty. This is the single most common reason ISO 14001 audits fail — having a legal register is not the same as checking against it.

When you find you are not complying, you must act on it and record what you did.

Evidence: Records of breaches, notices or exceedances, and the action taken. Regulator correspondence.

You must audit your own environmental system, covering the whole standard over time.

Evidence: An audit programme. Audit reports. Findings raised.

The must be audit plan based on where the environmental risk is, and on past problems.

Evidence: The reasoning behind the programme.

The auditors must be independent of the work they audit, and competent.

Evidence: Auditor training. Who audited what. In a small firm: swap with a colleague or use an outsider.

Senior management must review the system at planned intervals.

Evidence: Review dates and attendance.

The review must cover everything the standard asks for.

Evidence: An agenda covering: previous actions, changes in issues and duties, performance, compliance status, communications received, audit results, resources, improvement.

The review must produce decisions and actions, not just minutes.

Evidence: Decisions on improvement, changes to the system and resources. An action list with owners and dates.

10 Putting things right and getting better

Clauses 10.1, 10.2, 10.3.

You must look for ways to improve, rather than waiting for something to go wrong.

Evidence: Improvement register. Projects completed.

When something goes wrong or an incident happens, you must deal with it and limit the damage.

Evidence: Incident reports. Clean-up records. Containment.

You must then work out why it happened.

Evidence: Root cause notes. A method such as 5 Whys.

You must check whether the same thing could happen elsewhere — another tank, another site, another shift.

Evidence: Evidence you looked wider than the one incident.

You must check later that your fix actually worked, and update the aspects register or controls if needed.

Evidence: Follow-up record with a date. Revised aspects or procedures.

You must keep records of what went wrong, why, what you did, and the result.

Evidence: A corrective action log with all four.

You must be able to show your environmental performance is better than last year, not just that the paperwork is tidy.

Evidence: Trends in energy, water, waste or emissions, adjusted for how busy you were. Completed projects with numbers.

Using this document

Nothing above asks for a manual, a template pack, or a filing system. It asks for decisions that have been taken deliberately and can be shown to have been taken — which is a far smaller job than most organisations expect, and a different one.

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor finds the gap between the two. The test we apply is whether the person who has to do the job recognises their own work in what is written down.